Client-server transactional pre-archival apparatus

• US 8,725,704 B2
• Filed: 09/27/2011
• Issued: 05/13/2014
• Est. Priority Date: 09/27/2011
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Barracuda Networks Incorporated
• Inventors: Levow, Zachary
• Primary Examiner(s): LU, KUEN S
• Application Number:
  US13/246,834
• Publication Number:
  US 20130080407A1
• Time in Patent Office: 959 Days
• Field of Search: 707/692
• US Class Current: 707/692
• CPC Class Codes: G06F 16/2308 Concurrency control transaction processing G06F9/466

Abstract

An apparatus which receives client-server transactions such as HTTP REQUESTS and transforms them into a synopsis format for archival storage. HTTP transactions are logged and parsed for key words called HTTP METHODS. For each HTTP METHOD, data is extracted from the message or the resources provided by the transaction. The data is efficiently stored into a transaction store. The data is also indexed and the index is stored into the transaction store. A record is kept for all concurrent sessions by usernames associated with a directory entry.

Claims

1. A method for tracing data transfer across a network boundary between a user client on one side of the network boundary and a server apparatus on another side of the network boundary, wherein the data transfer is provided using http and https protocols,

the method using:

a client-server transaction prearchival analysis apparatus (CSTPA) that is separate from the user client and the server apparatus and that is responsive to communications that cross the network boundary,

a client-server transaction store apparatus having a non-transitory memory, the client-server transaction store apparatus separate from the user client and the server apparatus and responsive to the CSTPA, and

wherein the CSTPA includes a transformation circuit configured to convert one or more client user protocol data types into a single searchable format;

a rule-based parsing circuit;

an observer, decrypt, and protect circuit;

an indexing circuit; and

a record storage circuit;

the method comprising the steps of;

receiving, at the CSTPA, a plurality of protocol data types transmitted from the user client to the server apparatus across the network boundary;

transforming, using the transformation circuit, the protocol data types into a single searchable format, wherein the receiving of a plurality of protocol data types includes a post request transmitted from the user client to the server apparatus and the post request includes a payload comprising content;

parsing the post request for the content using the rule-based parsing circuit;

preventing data leakage from the CSTPA, wherein said preventing data leakage comprises identifying and protecting portions of the content from archival using the observer, decrypt, and protect circuit, and protecting is defined as replacing data with random noise, or redacting, masking, deleting, or hashing the data;

storing the content to the client-server transaction store using the record storage circuit;

indexing the content to produce indices using the transformation circuit alone or in conjunction with the indexing circuit;

storing the indices to a computer-readable medium in the client-server transaction store using the record storage circuit; and

updating parsing rules used by the rule-based parsing circuit and applying the updated parsing rules to previously stored content from the client-server transaction store using a link outside the network from the client-transaction store to the rule-based parsing circuit.

2. A computer accessible non-transitory storage device for recording client-server transactions that are transmitted across a network boundary between a user client and a server apparatus, said computer-accessible non-transitory storage device comprising instructions that, when executed by a computer or processor separate from the user client and the server apparatus, cause the computer or processor to:

transform client-server transaction data into a single synopsis format record;

store a synopsis format record of a transformed client-server transaction to an email archiver;

obtain a user identity for each client request;

examine contents of a client-server transaction for data that is sensitive, proprietary, confidential, personal, or violates a regulation for protecting privacy;

prevent data leakage from the computer or processor, wherein to prevent data leakage comprises the instructions to cause the computer or processor to identify and protect portions of the content from archival, and protecting is defined as replacing data with random noise, or redacting, masking, deleting, or hashing the data;

apply new parsing rules to stored transactions stored in the email archiver;

cross-reference multiple identities of users accessing different servers; and

match server responses to client requests to create a single client-server transaction.